From ad487e9c1d46da5b3448a6b48f464c0b26cb7c16 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 9 Sep 2026 09:45:35 +0000 Subject: [PATCH 1/3] fix: remove daemon initializer from private CLI build The daemon extension (github.com/snyk/ambient-canary) exposed an unauthenticated local HTTP endpoint that could be reached from a browser via a CORS simple request, allowing arbitrary CLI command execution without folder trust. It was only intended for internal testing and was never documented or announced. Remove the extension registration until a threat model review is completed. Co-authored-by: Bastian Doetsch --- cliv2-private/cmd/cliv2/main.go | 2 -- cliv2-private/go.mod | 6 ------ cliv2-private/go.sum | 9 --------- 3 files changed, 17 deletions(-) diff --git a/cliv2-private/cmd/cliv2/main.go b/cliv2-private/cmd/cliv2/main.go index 796e3da3e1..7e288e5437 100644 --- a/cliv2-private/cmd/cliv2/main.go +++ b/cliv2-private/cmd/cliv2/main.go @@ -3,7 +3,6 @@ package main import ( "os" - "github.com/snyk/ambient-canary/pkg/daemon" "github.com/snyk/cli-extension-axi/pkg/agent" "github.com/snyk/cli-extension-cos/pkg/cos" "github.com/snyk/remy-cli-extension/pkg/remy" @@ -17,7 +16,6 @@ func main() { core.WithAdditionalExtensions(agent.Init), core.WithAdditionalExtensions(remy.Init), core.WithAdditionalExtensions(cos.Init), - core.WithAdditionalExtensions(daemon.Init), core.WithAdditionalExtensions(rift.Init), )) } diff --git a/cliv2-private/go.mod b/cliv2-private/go.mod index 1e2d324e1f..dfa1f7b76a 100644 --- a/cliv2-private/go.mod +++ b/cliv2-private/go.mod @@ -3,7 +3,6 @@ module github.com/snyk/cli/cliv2-private go 1.26.6 require ( - github.com/snyk/ambient-canary v0.0.0-20260722064253-fba619a134a9 github.com/snyk/cli-extension-axi v0.0.0-20260901142946-cb915113acb7 github.com/snyk/cli-extension-cos v0.0.0-20260818151318-d63bb9db9484 github.com/snyk/cli/cliv2 v0.0.0 @@ -177,8 +176,6 @@ require ( github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/oapi-codegen/runtime v1.6.0 // indirect github.com/olekukonko/tablewriter v0.0.5 // indirect - github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a // indirect - github.com/opcoder0/fanotify v0.4.2 // indirect github.com/open-policy-agent/opa v0.69.0 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/otiai10/copy v1.14.1 // indirect @@ -238,7 +235,6 @@ require ( github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 // indirect github.com/stretchr/testify v1.11.1 // indirect github.com/subosito/gotenv v1.6.0 // indirect - github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465 // indirect github.com/tchap/go-patricia/v2 v2.3.1 // indirect github.com/tidwall/gjson v1.18.0 // indirect github.com/tidwall/match v1.1.1 // indirect @@ -326,6 +322,4 @@ replace github.com/snyk/cli/cliv2 => ../cliv2 // replace github.com/snyk/cli-extension-cos => ../../cli-extension-cos -// replace github.com/snyk/ambient-canary => ../../ambient-canary - // replace github.com/snyk/rift-cli-extension => ../../rift-cli-extension diff --git a/cliv2-private/go.sum b/cliv2-private/go.sum index 644057b4c2..8e0fe986da 100644 --- a/cliv2-private/go.sum +++ b/cliv2-private/go.sum @@ -495,10 +495,6 @@ github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY= github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY= github.com/onsi/gomega v1.38.0/go.mod h1:OcXcwId0b9QsE7Y49u+BTrL4IdKOBOKnD6VQNTJEB6o= -github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a h1:sbMMqulR2c6d2aeqOg5kzWv87unK0O4V78Dl1+YG4ys= -github.com/opcoder0/capabilities v0.0.0-20221222060822-17fd73bffd2a/go.mod h1:77JxdABQ4m37PtO4WMtRBrI+DDphomu/8tGeijYXspk= -github.com/opcoder0/fanotify v0.4.2 h1:Bp7h8scp/LNoWmC16Z1kf7GfxehhQLcDPxqJ31+SThs= -github.com/opcoder0/fanotify v0.4.2/go.mod h1:S0LITNqjkZwifQ+0qB1fT1S/SmDmnFH+h0SLBzoKW2Q= github.com/open-policy-agent/opa v0.69.0 h1:s2igLw2Z6IvGWGuXSfugWkVultDMsM9pXiDuMp7ckWw= github.com/open-policy-agent/opa v0.69.0/go.mod h1:+qyXJGkpEJ6kpB1kGo8JSwHtVXbTdsGdQYPWWNYNj+4= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= @@ -576,8 +572,6 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg= github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow= -github.com/snyk/ambient-canary v0.0.0-20260722064253-fba619a134a9 h1:d69mS5cTIs1eOcmMMUwr1kfvtiDyuSNLxET4lp/mCa4= -github.com/snyk/ambient-canary v0.0.0-20260722064253-fba619a134a9/go.mod h1:n6GYt41xPhThEEEl/0RZuWpTX68iv6k+6HZ94uGNDGE= github.com/snyk/cli-extension-agent-scan v0.0.0-20260803112735-0ad462cba2af h1:AgYHuCfs6oNkd/QFwsuEtvswclfBujhBfwbZUB4xEU4= github.com/snyk/cli-extension-agent-scan v0.0.0-20260803112735-0ad462cba2af/go.mod h1:u4d7qoWWVx3II+ZnpLQGjAegaJLmgPefXKXJD/jp/wM= github.com/snyk/cli-extension-ai-bom v0.0.0-20260817214817-d0a81ac40172 h1:dZQ2DnEnxV+v2yFRyuqUioSAGfXkiMcRQXndAeVsqi0= @@ -659,8 +653,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= -github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465 h1:yhxdTGmFkAM2TFA65c3NgGwpnIkUM8oVqPX2e9S7IVg= -github.com/syncthing/notify v0.0.0-20250528144937-c7027d4f7465/go.mod h1:J0q59IWjLtpRIJulohwqEZvjzwOfTEPp8SVhDJl+y0Y= github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes= github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k= github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= @@ -789,7 +781,6 @@ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= From e045397d45b3d7d80f66da66693683d19e6c84dd Mon Sep 17 00:00:00 2001 From: Octavian Comanescu Date: Wed, 9 Sep 2026 14:58:26 +0300 Subject: [PATCH 2/3] fix: bump gRPC dependency to fix CVE-2026-84445 --- cliv2-private/go.mod | 2 +- cliv2-private/go.sum | 4 ++-- cliv2/go.mod | 2 +- cliv2/go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/cliv2-private/go.mod b/cliv2-private/go.mod index dfa1f7b76a..d092612905 100644 --- a/cliv2-private/go.mod +++ b/cliv2-private/go.mod @@ -287,7 +287,7 @@ require ( google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff --git a/cliv2-private/go.sum b/cliv2-private/go.sum index 8e0fe986da..de3e5ad381 100644 --- a/cliv2-private/go.sum +++ b/cliv2-private/go.sum @@ -845,8 +845,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0= google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/cliv2/go.mod b/cliv2/go.mod index 876be7e22b..f7150d5e75 100644 --- a/cliv2/go.mod +++ b/cliv2/go.mod @@ -258,7 +258,7 @@ require ( google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff --git a/cliv2/go.sum b/cliv2/go.sum index 45508f9553..218d62e3f8 100644 --- a/cliv2/go.sum +++ b/cliv2/go.sum @@ -781,8 +781,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0= google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From cff0212d0dc6aba9784fd3048b006a974c1e05d5 Mon Sep 17 00:00:00 2001 From: Octavian Comanescu Date: Wed, 9 Sep 2026 14:17:28 +0300 Subject: [PATCH 3/3] docs: update RELEASE_NOTES.md --- binary-releases/RELEASE_NOTES.md | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/binary-releases/RELEASE_NOTES.md b/binary-releases/RELEASE_NOTES.md index af3195659e..d5aeef5524 100644 --- a/binary-releases/RELEASE_NOTES.md +++ b/binary-releases/RELEASE_NOTES.md @@ -1,17 +1,9 @@ -## [1.1307.1](https://github.com/snyk/snyk/compare/v1.1307.0...v1.1307.1) (2026-09-07) +## [1.1307.2](https://github.com/snyk/snyk/compare/v1.1307.1...v1.1307.2) (2026-09-09) The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see [this documentation](https://docs.snyk.io/snyk-cli/releases-and-channels-for-the-snyk-cli) ### Bug Fixes -* **test**: `snyk test` on a repository with no supported manifest files again reports `SNYK-CLI-0008` and exits 3, instead of a generic `SNYK-CLI-0000` with exit 2. `snyk test --json` writes the error document to stdout as expected. ([50cad38](https://github.com/snyk/snyk/commit/50cad38868eef07c68a8bf002f51edec90360151)) -* **test**: Restores `moduleName`, `insights.triageAdvice`, and `functions_new` fields in `snyk test --json` output. ([4ec3d18](https://github.com/snyk/snyk/commit/4ec3d18904fe000bcc33a8bbc9ac85f9000c93d6)) -* **test**: `.snyk` policy files are now handled correctly in the unified test flow -- empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that previously caused incorrect results or failures. ([a22a563](https://github.com/snyk/snyk/commit/a22a5635f2cb119fdb676c786a10b1fd8cb8a804)) -* **general**: Fixes a case where CLI commands that complete with findings (exit 1) could produce duplicate or corrupt JSON output when an unrelated network error occurred during the run. ([836ee0d](https://github.com/snyk/snyk/commit/836ee0db1bf3462ee8df227cecfe373c0cf282df)) -* **general**: Fixes debug-log scrubber so that secrets are consistently masked and scrubbing no longer corrupts the surrounding JSON structure. ([d89333a](https://github.com/snyk/snyk/commit/d89333abc9765088faf50953f9e8ed4f8e65b2bf)) -* **container**: Container scans now surface source repository information for locally built images using BuildKit metadata. ([dd6ff36](https://github.com/snyk/snyk/commit/dd6ff36ad2dbd433dda127d065d96e219dd3d146)) +* **security**: Removed an unused experimental feature. ([ad487e9](https://github.com/snyk/snyk/commit/ad487e9c1d46da5b3448a6b48f464c0b26cb7c16)) * **deps**: Updates dependencies to fix vulnerabilities: - - CVE-2022-25883 ([465d5f3](https://github.com/snyk/snyk/commit/465d5f3ac81fe330f152579f0e6a20217f2015b5)) - - CVE-2026-84304 ([27f00a1](https://github.com/snyk/snyk/commit/27f00a172359cfad66d6b10c24f69a91b2eef8cc)) - - CVE-2026-84375 ([5ceea33](https://github.com/snyk/snyk/commit/5ceea33da5e83f86957182b8b9eb3736d55909ae)) - - SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090 ([4ec3d18](https://github.com/snyk/snyk/commit/4ec3d18904fe000bcc33a8bbc9ac85f9000c93d6)) + - CVE-2026-84445 ([b7aec1d](https://github.com/snyk/snyk/commit/b7aec1d6787ebb517b32edb8c0218e7ca20885b2))